alfi.de
Scanned 8 days ago · Oct 22, 2026, 9:24 AM
D
Security Headers
The HTTP response headers browsers use to restrict what a page - or an attacker inside it - can do.
Score45%
- no Referrer-Policy header
- no Permissions-Policy header
- no Cross-Origin-Opener-Policy header
- no Cross-Origin-Resource-Policy header
- the Server header discloses "cloudflare"
- cookie "localization" is missing the Secure flag
- cookie "localization" is missing the HttpOnly flag
- cookie "cart_currency" is missing the Secure flag
- cookie "cart_currency" is missing the HttpOnly flag
Content-Security-Policyblock-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;
Strict-Transport-Securitymax-age=7889238
X-Content-Type-Optionsnosniff
X-Frame-OptionsDENY
Referrer-Policynot set
Permissions-Policynot set
Cross-Origin-Opener-Policynot set
Cross-Origin-Resource-Policynot set
Cookieslocalization (no flags); cart_currency (no flags); _shopify_essential (Secure, HttpOnly)